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FIG. 8A 

802 
\ 

protocol "IP" {// 

len=valueof(field "Total Length")*8 
/ minLen=20*8 //just header 
804 maxLen= 65535*8 
header "IP Header" 
806 ^P a y ,oad " ,p Payload" 
808 

header "IP Header" {// 

810 

\ / len = valueof (field "Header Length")*32 
81 2^ field "Version" 818 
816 field "Header Length" ' 

/ compound_fieid Type Of Service" 
81 4^ field "Total Length" 

824 820 

field "Identification" {len=16 default=291 } ^ 
/ compoundjield "Flags" 822 
815 field "Fragment Offset" {len = 13 desc="in 64 bits units"} ' 826 
field 'Time To Live" {len=8 default=30 desc="seconds"} ' 
/field "Protocol" 830 
828 field "Header Checksum" ' 

Afield "Source IP Address" {len=32 display=ipv4 fieid_type= 
832 must_encode} 

afield "Destination IP Address" { 
834 len=32 

display =ipv4 

fieldjype = must_encode 

} 
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repeat { 

len=valueof (field "Header Length") - 5 )*32//includes padding 
compoundjield "Options" 

} 

field 'Version" { 

len=4 

default =4 

possible_values={ 
0,15:"Reserved" 
1-3:"Unassigned" 

6-14:"Unassigned" 
4:"IP Internet Protocol" 
5:"ST ST Datagram Mode" 
}} 

field "Header Length" { 
len=4 

minValue=5 
desc="in 32 bit units" 

default=eval_fn(len, "IP", "IP Header", 732") 

} 

field "Total Length" { 

minVaiue=20 
len=16 

desc="in octets include header length" 
default=eval_fn(len, "IP", "IP", 78") 

} 

field "Header Checksum" { 
len=16 

defauit=eval_fn(checksum, "IP", "IP Header") 
display = hex 

} 
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FIG. 8C 

compound_field "Type Of Service" {// 

display = hex 

field "precedence" { 

len=3 

possible_values= { 

0: "Routine" 
1: "Priority" 
2:"lmmediate" 
3:"Flash" 

4:"Flash override" 
5:"CRITIC/ECP" 
6:"lnternetwork Control" 
7:"Network Control" 
}} 

field "Delay" { 
len=1 

possible_values={0:"normal" 1 :"low"}} 
field "Throughput" { 
len=1 

possible_values={0:"normal" 1 :"high"}} 

field "Reliability" { 
len=1 

possible_values={0:"normal" 1 :"high"}} 

field "Monetary Cost" { 
len=1 

possible_values={0:"normal" 1 :"low"}} 

field "Unused" { 
len=1 

possible_values= {0:"valid"}} 
}// end of field "Type of Service" 
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FIG. 8D 

compound_field "Flags" { 
len=3 

display = hex 
field "Reserved" { 
len=1 

possible_values={0:"valid"}} 

field "Fragment" { 
len=1 

possible_values={0:"May Fragment" 1:"Don't Fragment"}} 
field "Fragments" { 
len=1 

possible_values={0:"last" 1 :"more"}} 

} 

compoundfield "Options" {// 

optional = (valueof(field "Header Length") > 5) 
compound_fieid "Option Tuple" 

{ 

len=8; 
display=hex 
field "Copied Flag" { 
len=1 

possible_values={0:"not copied into all fragments 
0:"not copied into all fragments on fragmentation" 
1 :"copied into all fragments on fragmentation" 

}} 

field "Option Class" { 
len=2 

possible_values= { 
(^"control" 
1 : "reserved for future use" 

2."debugging and measurement" 
3:"reserved for future use" 

}} 
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FIG. 8E 

field "Option Number" { 
ien=5 

field_type= muiopt_other_f Id 
possible_values= { 
0:"end of option list" 
1 :"no operation" 
2:"security" 

3:"loose source routing" 
4:"internet timestamp" 

7:"record route" 
8:"stream ID" 

9:"strict source routing" 

}} 
} 

switch (valueof (field "Option Number")) { 
0:null 
1:null 

2:compound_field "Security" 
3:compound_field "Loose Source Routing" 
9:compound_field "Strict Source Routing" 
7:compound_field "Record Route" 
8:compound_field "Stream ID" 
4:compound_field "Internet Timestamp" 

} 

compound field "Security" { 
len=80 

field "Security Length" { 
len=8 

possi ble_values = {0x0b: "val id"} } 
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FIG. 8F 

field "Security: Security" 

field "Compartments" {len=16} 

field "Handling Restrictions" {len=16} 

field "Transmission Control Code" {len=24} 

field "Security Security" { 
len=16 

possible_values= { 
0:"unclassified" 
0xf1 35: "confidential" 
0x0789a:"EFTO" 
0xbc4d:"MMMM" 
0x5e26:"PROG" 
Oxaf 13: "Restricted" 
0xd788:"Secret" 
0x6bc5:"Top Secret" 
0x35e2,0x9af1 ,0x4d78,0x24bd,0x1 35e,0x89af,0xc4d6,0xe26b: 
"Reserved for future use" 

}} 

} 

compoundjield "Strict Source Routing" { 
len=(valueof (field "Strict Source Routing Length")-1*8 
field "Strict Source Routing Length" {len=8 } 
field "Strict Source Routing Pointer" {len=8 minValue=4} 

repeat { 

len=(valueof (field "Strict Source Routing Length") -3) *8 

field "source address" {len=32 display =ipv4} 

} 

} 
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FIG. 8G 

compoundjield "Loose Source Routing" { 
len=(valueof (field "Loose Source Routing Length")-1*8 
field "Loose Source Routing Length" {len=8 } 
field "Loose Source Routing Pointer" {len=8 minValue=4} 

repeat { 

len={valueof (field "Loose Source Routing Length")-3)*8 

field "source address" {len=32 display =ipv4} 

} 

} 

compoundjield "Record Routing" { 
len=(valueof (field "Record Routing Length")-1)*8 
field "Record Routing Length" {len=8 } 
field "Record Routing Pointer" {len=8 minValue=4} 

repeat { 

len=(valueof (field "Record Routing Length")-3)*8 
field "source address" {len=32 display=ipv4} 
} 

} 

compoundjield "Stream ID" { 
len=24 

field "Stream ID Length" { 
len=8 

default=4 
possible_values= 
0x04:"valid" 

}} 

field "ID" {len=16 default=4} 

} 
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FIG. 8H 

compoundjield "Internet Timestamp" { 
field "Internet Timestamp Length" {len=8 } 
field "Internet Timestamp Pointer" {len=8 } 
field "Overflow" { 
len=4 

desc="number of IP modules that cannot register timestamps" 
} 

field "Flag" { 
len=4 

possible_values=1 
0:"time stamps only, stored in consecutive 32-bit words" 
1 :"each timestamp is preceded with internet address" 
3:"the internet address fields are prespecified" 
}} 

} // end of Internet Timestamp 
} // end of field "option" 

}// end of field "IP" 

field "Protocol" { 
len=8 

default=255 

fieldjype = mulopt_prtcl_fld 
display = hex 

possible_values={ // 

0:"HOPOPT (IPv6 Hop-by-Hop Option)" 
1 :"ICMP (Internet Control Message)" 
2:"IGMP (Internet Group Management)" 
3:"GGP (Gateway-to-Gateway)" 
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FIG. 81 

4:"IP (IP in IP encapsulation)" 

5:"ST (Stream)" 

6:"TCP" 

7:"CBT" 

8:"EGP (Exterior Gateway Protocol)" 

9:"IGP (any private interior gateway)" 

10:"BBN-RCC-MON (BBN RCC Monitoring)" 

1 1 :"NVP-II (Network Voice Protocol)" 

12:"PUP" 

13:"ARGUS" 

14:"EMCON" 

15:"XNET (Cross Net Debugger)" 

16:"CHAOS" 

17:"UDP" 

18:"MUX (Multiplexing)" 

19:"DCN-MEAS (DCN Measurement Subsystems)" 

20:"HMP (Host Monitoring)" 

21 : i! PRM (Field Radio Measurement)" 

22:"XNS-IDP (XEROX NS IDP)" 

23:"TRUNK-1 (Trunk-1)" 

24:"TRUNK-2 (Trunk-2)" 

25:"LEAF-1 (LeaM)" 

26:"LEAF-2 (Leaf-2)" 

27:"RDP (Reliable Data Protocol)" 

28:"IRTP (Internet Reliable Transaction)" 

29:"ISO-TP4 (ISO Transport Protocol Class 4)" 

30:"NETBLT (Bulk Data Transfer Protocol)" 

31 :"MFE-NSP (MFE Network Services Protocol)" 

32:"MERIT-INP (MERIT Internodal Protocol)" 

33: "SEP (Sequential Exchange Protocol)" 

34:"3PC (Third Party Connect Protocol)" 

35:"IDPR (Inter-Domain Policy Routing Protocol)" 

36:"XTP (XTP)" 
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FIG. 8J 

37:"DDP (Datagram Delivery Protocol)" 

38:"IDPR-CMTP (IDPR Control Message Transport Protocol)" 

39:'TP++ (TP++ Transport Protocol)" 

40:"IL (IL Transport Protocol)" 

41:"IPv6(IPv6)" 

42:"SDRP (Source Demand Routing Protocol)" 
43:"IPv6-Route (Routing Header for IPv6)" 
44:"IPv6-Frag (Fragment Header for IPv6)" 
45:"IDRP (Inter-Domain Routing Protocol)" 
46:"RSVP (Reservation Protocol)" 
47:"GRE (General Routing Encapsulation)" 
48:"MHRP (Mobile Host Routing Protocol)" 
49:"BNA" 

50:"ESP (Encap Security Payload for IPv6)" 

51 :"AH (Authentication Header for IPv6)" 

52:"I-NLSP (Integrated Net Layer Security TUBA)" 

53:"SWIPE (IP with Encryption)" 

54:"NARP (NBMA Address Resolution Protocol)" 

55:"MOBILE (IP Mobility)" 

56:"TLSP (Transport Layer Security Protocol)" 

57:"SKIP" 

58:"IPv6-ICMP (ICMP for IPv6)" 

59:"IPv6-NoNxt (No Next Header for IPv6)" 

60:"IPv6-Opts (Destination Options for IPv6)" 

61:"AHP (Any Host Internal Protocol)" 

62:"CFTP (CFTP)" 

63:"ALN (Any Local Network)" 

64:"SAT-EXPAK (SATNET and Backroom EXPAK)" 

65:"KRYPTOLAN (Kryptolan)" 

66:"RVD (MIT Remote Virtual Disk Protocol)" 

67:"IPPC (Internet Pluribus Field Core)" 

68:"ADFS (Any Distributed File System)" 

69:"SAT-MON (SATNET Monitoring)" 

70:"VISA (VISA Protocol)" 
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71:"IPCV (Internet Field Core Utility)" 

72:"CPNX (Computer Protocol Network Executive)" 

73:"CPHB (Computer Protocol Heart Beat)" 

74:"WSN (Wang Span Network)" 

75:"PVP (Field Video Protocol)" 

76:"BR-SAT-MON (Backroom SATNET Monitoring)" 

77:"SUN-ND (SUN ND PROTOCOL-Temporary)" 

78:"WB-MON (WIDEBAND Monitoring)" 

79:"WB-EXPAK (WIDEBAND EXPAK)" 

80:"ISO-IP (ISO Internet Protocol)" 

81:"VMTP" 

82:"SECURE-VMTP" 

83:"VINES" 

84:"TTP" 

85:"NSFNET-IGP" 

86:"DGP (Dissimilar Gateway Protocol)" 

87:TCF" 

88:"EIGRP" 

89:"OSPF" 

90:"Sprite-RPC (Sprite RPC Protocol)" 

91 :"LARP (Locus Address Resolution Protocol)" 

92:"MTP (Multicast Transport Protocol)" 

93:"AX.25 (AX.25 Frames)" 

94:"IPIP (IP-within-IP Encapsulation Protocol)" 

95:"MICP (Mobile Internetworking Control Pro)" 

96:"SCC-SP (Semaphore Communications Sec. Pro)' 

97:"ETHERIP (Ethernet-within-IP Encapsulation)" 

98:"ENCAP (Encapsulation Header)" 

99:"APES (Any Private Encryption Scheme)" 

100:"GMTP" 

101:"IFMP (Ipsilon Flow Management Protocol)" 

102:"PNNI (PNNI over IP)" 

103:"PIM (Protocol Independent Multicast)" 

104:"ARIS" 
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FIG. 8L 



105:"SCPS" 
106:"QNX" 

107:"A/N (Active Networks)" 

108:"IPPCP (IP Payioad Compression Protocol)" 

109:"SNP (Sitara Networks Protocol)" 

110:"Compaq-Peer (Compaq Peer Protocol)" 

111:"IPX-in-IP" 

112:"VRRP (Virtual Router Redundancy Protocol)" 
113:"PGM (PGM Reliable Transport Protocol)" 
1 14:"AHOP (Any 0-hop protocol)" 
1 1 5-254:"Unassigned" 
255:"Reserved" 
}} // end of field "protocol" 

}// end of field "IP header" 

836 

\ payioad "IP Payioad" {// 

^ switch(valueof(field "Protocol")) { 
838 1:protoconCMP" 
2:protocol "IGMP" 
6: protocol "TCP" 
17:protocol "UDP" 
46:protocol "RSVP" 
47: protocol "GRE" 
89.protocol "OSPF" 
} 

} // end of packet "IP payioad" 
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tc1 - (enabledSilent() ==TRUE) 
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